Estimating  Vulnerabilities  in  Large  Covert  Networks 

Kathleen  M.  Carley 
ISRI 

Carnegie  Mellon  University 


Contact: 

Prof.  Kathleen  M.  Carley 

Institute  for  Software  Research  International 

Carnegie  Mellon  University 

Pittsburgh,  PA  15213 

Tel:  1-412-268-6016 
Fax:  1-412-268-1744 
Email:  kathleen.carley@cmu.edu 

Modeling  and  Simulation 

This  paper  is  part  of  the  Dynamic  Networks  project.  This  work  was  supported  in  part  by  the 
Office  of  Naval  Research  (ONR),  United  States  Navy  Grant  No.  N00014-02-10973  on  Dynamic 
Network  Analysis  under  the  direction  of  Rebecca  Goolsby  and  Grant  No.  N000 14-97- 1-0037  on 
Adaptive  Architecture  under  the  direction  of  Bill  Vaughn.  Additional  support  was  provided  by 
the  DOD  and  NSF  MKIDS  program. 


Report  Documentation  Page 

Form  Approved 

OMB  No.  0704-0188 

Public  reporting  burden  for  the  collection  of  information  is  estimated  to  average  1  hour  per  response,  including  the  time  for  reviewing  instructions,  searching  existing  data  sources,  gathering  and 
maintaining  the  data  needed,  and  completing  and  reviewing  the  collection  of  information.  Send  comments  regarding  this  burden  estimate  or  any  other  aspect  of  this  collection  of  information, 
including  suggestions  for  reducing  this  burden,  to  Washington  Headquarters  Services,  Directorate  for  Information  Operations  and  Reports,  1215  Jefferson  Davis  Highway,  Suite  1204,  Arlington 

VA  22202-4302.  Respondents  should  be  aware  that  notwithstanding  any  other  provision  of  law,  no  person  shall  be  subject  to  a  penalty  for  failing  to  comply  with  a  collection  of  information  if  it 
does  not  display  a  currently  valid  OMB  control  number. 

1.  REPORT  DATE 

JUN  2004  2.  REPORT  TYPE 

3.  DATES  COVERED 

00-00-2004  to  00-00-2004 

4.  TITLE  AND  SUBTITLE 

Estimating  Yulnerablities  in  Large  Covert  Networks 

5a.  CONTRACT  NUMBER 

5b.  GRANT  NUMBER 

5c.  PROGRAM  ELEMENT  NUMBER 

6.  AUTHOR(S) 

5d.  PROJECT  NUMBER 

5e.  TASK  NUMBER 

5f.  WORK  UNIT  NUMBER 

7.  PERFORMING  ORGANIZATION  NAME(S)  AND  ADDRESS(ES) 

Carnegie  Mellon  University, Institute  for  Software  Research 

International, Pittsburgh, PA, 15213 

8.  PERFORMING  ORGANIZATION 

REPORT  NUMBER 

9.  SPONSORING/MONITORING  AGENCY  NAME(S)  AND  ADDRESS (ES) 

10.  SPONSOR/MONITOR’S  ACRONYM(S) 

11.  SPONSOR/MONITOR’S  REPORT 
NUMBER(S) 

12.  DISTRIBUTION/AVAILABILITY  STATEMENT 

Approved  for  public  release;  distribution  unlimited 

13.  SUPPLEMENTARY  NOTES 

The  original  document  contains  color  images. 

14.  ABSTRACT 

15.  SUBJECT  TERMS 

16.  SECURITY  CLASSIFICATION  OF:  17.  LIMITATION  OF 

APS!TP  act 

1 8 .  NUMBER  1 9a.  NAME  OF 

nc  pa  cue:  puqpcmqtpt  u  pupqcm 

a.  REPORT  b.  ABSTRACT  c.  THIS  PAGE 

unclassified  unclassified  unclassified 

41 

Standard  Form  298  (Rev.  8-98) 

Prescribed  by  ANSI  Std  Z39-18 


Estimating  Vulnerabilities  in  Large  Covert  Networks 

Abstract 

Covert  organizations,  such  as  terrorist  groups,  have  network  structures  that  are  distinct  from 
those  in  typical  hierarchical  organizations;  e.g.,  they  are  cellular  and  distributed.  Reasoning 
about  how  to  attack  dynamic  networked  organizations,  let  alone  figuring  out  how  they  are  likely 
to  evolve,  change,  and  adapt  is  terribly  difficult.  In  this  paper,  an  approach  to  estimating 
vulnerabilities  and  the  impact  of  eliminating  those  vulnerabilities  in  covert  networks  is 
presented.  Key  features  of  this  work  include:  using  detailed  network  data  to  supplement  high 
level  views  of  organizations  to  create  a  composite  image,  using  network  metrics  for  mult-mode, 
multi-plex  data  to  characterize  key  actors  and  the  network  itself,  and  using  multi-agent 
simulation  to  predict  change  in  the  composite  network  view  over  time.  Uncertainty  is  handled 
by  using  two  types  of  data  to  reduce  uncertainty,  running  the  model  in  a  Monte-Carlo  fashion  to 
determine  the  robustness  of  the  results,  and  examining  the  robustness  of  the  results  under  adding 
and  dropping  nodes  and  edges  in  the  underlying  networks.  This  approach  is  illustrated  by 
contrasting  the  differential  predictions  for  al-Qa’ida  and  Hamas  as  the  top  leaders  are  removed. 
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Estimating  Vulnerabilities  in  Large  Covert  Networks 

Covert  organizations,  such  as  terrorist  groups,  have  network  structures  that  are  distinct  from 
those  in  typical  hierarchical  organizations;  e.g.,  they  are  cellular  and  distributed.  Reasoning 
about  how  to  attack  dynamic  networked  organizations  (Ronfelt  and  Arquilla,  2001),  let  alone 
figuring  out  how  they  are  likely  to  evolve,  change,  and  adapt  is  terribly  difficult.  Part  of  this 
difficulty  stems  from  their  covert  nature. 

Social  network  analysis  employs  sets  of  tools  and  theories  developed  to  collect,  analyze  and 
explain  the  topology  of  networks  formed  by  who  talks  to,  works  with,  is  connected  to  whom  and 
the  relevance  of  position  in  this  network  to  individual  and  group  outcomes.  Clearly  social 
networks  can  be  applied  to  the  study  of  covert  networks  (Sparrow,  1991).  Many  are  stepping 
forward  suggesting  that  to  understand  these  networks  we  just  need  to  “connect  the  dots”  and  then 
isolate  the  “key  actors  who  are  often  defined  in  terms  of  their  “centrality”  in  the  network.  To  an 
extent,  this  is  right.  However,  it  belies  the  difficulty  of  “connecting  the  dots”  in  terms  of  mining 
vast  quantities  of  information,  pattern  matching  on  agent  characteristics  for  people  who  go  under 
multiple  aliases,  and  still  ending  up  with  information  the  may  be  intentionally  misleading, 
inaccurate,  out-of-date,  and  incomplete.  Further,  this  belies  the  difficulty  in  “knowing”  who  the 
“network  elite”  are  when  you  have  at  best  only  a  sample  of  the  network.  Finally,  and  critically, 
this  approach  does  not  contend  with  the  most  pressing  problem  -  the  underlying  network  is 
dynamic.  Just  because  you  isolate  a  key  actor  or  formal  leader  today  does  not  mean  that  the 
network  will  be  destabilized  and  unable  to  respond.  Rather,  it  is  possible,  that  isolating  such  an 
actor  may  have  the  same  effect  as  cutting  off  the  Hydra’s  head;  many  new  key  actors  or  leaders 
may  emerge  (Carley,  Lee  and  Krackhardt,  2001)  and  they  may  be  more  prone  to  hostile  activity 
than  their  predecessor. 

To  understand  the  dynamics  of  terrorist,  and  indeed  any,  network  we  need  to  understand  the 
basic  processes  by  which  networks  evolve.  Moreover,  we  have  to  evaluate  isolation  strategies  in 
the  face  of  an  evolving  network  and  in  the  face  of  missing  information.  To  ignore  either  the 
dynamics  or  the  lack  of  information  is  liable  to  lead  to  erroneous,  and  possibly  devastatingly 
wrong,  policies.  Taking  in  to  account  both  the  dynamics  and  the  lack  of  information  should 
engender  a  more  cautious  approach  in  which  we  can  ask,  “What  are  likely  to  be  the  effects  of  an 
action.”  This  is  critical  if  we  are  to  reduce  surprise  in  the  field  and  enable  planning  of  operations 
that  takes  in  to  account  effects  due  to  network  dynamics. 

In  this  paper,  the  limits  of  standard  social  network  analysis  as  they  relate  to  the  extraction 
and  analysis  of  covert  networks  are  described,  This  is  followed  by  a  discussion  of  the  types  of 
“errors”  that  are  likely  to  appear  in  relational  data  and  the  way  that  shapes  the  observed  network 
Possible  procedures  for  reducing  such  errors  are  then  described.  Then  the  impact  of  such  errors 
on  estimating  key  actors  is  then  discussed.  This  is  followed  by  a  discussion  of  what  happens 
when  key  actors  are  isolated.  Then  a  series  of  studies,  showing  the  impact  of  these  types  of 
missing  information  on  locating  vulnerabilities  in  different  classes  of  networks  will  be  provided. 
The  results  place  the  analysis  of  destabilization  strategies  in  a  risk  framework  allowing  the 
analyst  to  estimate  the  chances  that  they  are  wrong. 

1  Available  Data 

Available  data  exists  in  a  variety  of  forms  including,  but  not  limited  to,  newspaper  articles, 
websites,  commentaries  by  subject  matter  experts,  Humlnt  reports.  Information  can  be  extracted 
from  such  data  in  terms  of  general  high-level  guidelines  and  specific  detailed  relations.  General 
guidelines  are  comments  such  in  al-Qa’ida  each  cell  is  designed  to  cover  a  number  of  skills  or 


2 


Hamas  is  organized  functionally  and  by  region.  In  contrast  specific  relational  data  is  of  the  form 
Usama  bin  Ladin  is  the  head  of  al-Qa'ida.  Different  types  of  errors  are  prone  to  exist  in  both 
types  of  information.  By  utilizing  both  types  of  information  a  more  informed  decision  about 
potential  actions  can  be  made  and  the  strengths  of  one  type  of  data  can  be  used  to  overcome  the 
limitations  of  the  other.  However,  the  granularity  of  these  two  types  of  data  is  so  different  that 
most  tools  cannot  handle  both  types  of  data.  What  is  needed  is  an  approach,  a  set  of  tools,  which 
can  take  advantage  of  both  levels  of  data.  This  work  moves  us  toward  such  an  approach. 

1.1  High  Level  Data 

Current  information  suggests  that  the  structures  of  al-Qa’ida  and  Hamas  are  different  in  key 
ways.  For  example,  information  on  al-Qa’ida  suggests  that  it  is  organized  in  a  very  distributed 
cellular  form  (see  table  1).  At  least,  this  appears  to  be  the  case  for  the  central  core  of  al-Qa’ida 
although  it  often  links  to  other  terrorist  groups  by  infiltrating  and  “greening”;  i.e.,  teaching  them 
how  to  act  like  the  central  core,  implying  support  (possibly  providing  support)  if  al-Qa’ida  best 
practices  are  followed,  and  so  on.  In  contrast,  information  on  Hamas  indicates  that  its  structure 
exhibits  a  more  rigid  structure  (see  table  1)  organized  in  an  almost  matrix  form  by  function  and 
region.  Information  such  as  that  shown  in  table  1  is  extracted  from  subject  matter  experts,  built 
up  over  experience,  and  the  quality  depends  on  the  number  of  different  experts  who  are 
consulted  and  their  views  about  what  factors  are  important  in  characterizing  groups.  Such  data, 
is,  in  this  sense,  much  more  subjective;  but,  provides  a  high  level  view. 


Table  1. 

General  Features  of  Terrorist  Groups 

Feature 

al-Qa’ida 

Hamas 

Organizational  structure 

Top-hierarchy  with  underlying 
cellular  for  central  al-Qa’ida 
connected  hierarchically  to  related 
groups  like  JI 

Matrix  -  by  region  and  function 

Cells 

Distributed  skills  in  cells 

Same  skills  in  cells 

Missions  -  small 

Planned,  executed,  funded  by  cell 

Planned  by  function,  executed 
locally,  funded  regionally 

Missions  -  large 

Planned,  funded,  and  executed  by 
multiple  cells  under  temporary 
hierarchical  coordination  structure 

Matrix  planning  and  funding 
coordinating  execution  by  multiple 
cells 

Cell  orientation 

Mission  -  unlimited  number  of 
missions 

Function  -  there  are  five  basic 
functions 

Cell  leaders 

More  experience/  broader 
knowledge 

More  experience/  similar  knowledge 
/  political  connections 

Connection  among  cell  leaders 

Similarity  (historical) 

By  function  and  region 

Locus  of  control 

Distributed  -  cells  can  operate 
independently  for  small  missions 

Predominantly  centralized  -  cells 
coordinated  by  regional  and 
functional  leader 

Directives 

Can  come  from  higher  up 

Always  come  from  higher  up 

Executive  group 

Broad 

Narrow 

Members  of  executive  group  (power 
in  terrorist  group) 

Some  cell  leaders 

Most  functional  and  regional  leaders 

Political  power  in  community 

Varies 

Regional  leaders  are  often  powerful 

Integration  with  community 

Moderate  to  low 

Hidden 

Reasonably  high 

Infrastructure  cells  legitimate 
businesses 

Operational  cells  infiltrated  into 
police,  military  etc. 

Connection  to  other  terrorist  groups 

Hierarchical 

Lateral  -  through  intermediaries 
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Such  data  can  be  used  to  generate  an  overall  picture  of  the  structure.  This  picture  can  be 
augmented  when  reports  indicate  who  fills  what  role.  In  the  case  of  al-Qa’ida  the  picture  would 
look  like  that  in  Figure  1  with  Usama  bin  Ladin  taking  on  the  overall  lead.  Whereas,  in  the  case 


Figure  1.  al-Qa’ida  Structure 


Figure  2.  Hamas  when  Sheik  Ahmed  Yassin  was  Alive 
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of  Hamas,  when  Sheik  Ahmed  Yassin  was  alive  such  additional  information  would  result  in  a 
picture  such  as  that  in  Figure  2  with  Yassin  taking  on  the  overall  lead.  In  general  in  these  figures 
only  reports  to  lines  are  shown.  In  the  case  of  Hamas,  we  have  supplemented  this  with  two 
dashed  lines  indicating  the  known  disagreement  of  Yassin  and  Meshaal  and  the  movement  of 
Meshaal  from  operations  in  Gaza  to  Damascus. 

Of  particular  interest  from  a  simulation  standpoint  is  the  way  in  which  the  cells  are 
organized.  In  al-Qa’ida  the  cells  can  be  self  sufficient.  Many  have  independent  control  for  their 
own  finance,  infrastructure  and  operations,  although  there  appear  to  be  support  cells  which  can 
provide  fiance,  recruitment  and  training  services.  Many  cells  are  mission  oriented.  One  key 
issue  is  that  connections  or  ties  among  cells  appear  to  be  predominantly  at  the  leader  level 
whereas  there  appears  to  be  all-to-all  communication  within  cells.  However,  the  connections 
among  cells  may  only  be  activated  for  particular  missions.  In  contrast,  in  Hamas  there  are  four 
operations  wings:  internal  security  (Jihad  Amman),  "popular  uprising"  (stage  violent  protests, 
stone  throwing,  etc),  suicide  bomber  group  (Al-Majahadoun  Al-Falestinioun),  professional  killer 
group  (The  Izz  al-Din  al-Qassam  Squads),  and  an  “infrastructure”  group  that  is  often  composed 
of  domestic  finance,  domestic  recruiting,  and  religious  activities.  Each  of  the  functional 
operational  cells  has  one  or  more  high-ranking  officers  who  report  to  the  Gaza  HQ 
or  West  Bank  HQ  (depending  on  location  and  sometimes  to  both).  Gaza  HQ  is  more  powerful, 
probably  the  leaders  of  that  functional  branch.  For  infrastructure  the  leader  of  each  regional 
infrastructure  cell  also  reports  to  the  GAZA  infrastructure  leader.  All  Gaza  infrastructure  leaders 
report  to  Yassin.  Within  some  regions  certain  operational  cells  may  be  dormant,  hidden  or 
sleeping  -  such  as  in  Damascus,  Lebanon,  Egypt  and  other  regions  like  the  USA.  Thus,  although 
missions  are  often  carried  out  by  cells  those  cells  are  coordinated  to,  tied  to,  both  functional  and 
regional  leaders. 

1.2  Detailed  Data 

In  contrast  to  this  high  level  view  is  the  more  specific  network  or  individual  level  data.  In 
this  latter  case,  text  analysis  can  be  used  to  scan  for  specific  relations.  Such  an  analysis  might 
result  in  a  figure  like  the  famous  Krebs  (2002)  -  9-11  hijacking  figure  -  redisplayed  in  Figure  3. 
In  many  organizations,  social  network  analysts  collect  such  data  by  administering  questionnaires. 
Such  an  approach  is  clearly  unfeasible  for  terrorist  groups.  Alternatively,  such  networks  can  be 
collected  from  archived  data  sources  such  as  phone  records,  newspaper  reports,  webpages  or 
Humlnt.  Texts  sources  can  be  used  to  collect  relations.  Krebs,  in  constructing  the  figure 
displayed  as  Figure  3,  drew  on  articles  in  major  newspapers  (such  as  Sydney  Morning  Herald, 
2001;  Washington  Post,  2001). 
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Figure  3.  Krebs  (2002)  9-11 
Hijacking  Data,  copyright  held  by 
First  Monday 

Krebs,  of  course,  extracted  this  data 
manually.  Each  day  he  read  additional 
papers  and  one  by  one  added  new  ties. 
There  are,  however,  some  text  analysis 
techniques  that  can  semi-automate  this 
process  such  as  AutoMap  (CMU: 

http://casos.cs.cmu.edu 
/proi  ects/automap/  Diesner  and 
Carley,  2004).  However,  none  of 
these  techniques  completely 
eliminates  the  need  for  some  human 
coder  intervention.  Such  tools  will 
facilitate  the  collection  of  detailed 
data. 

2  Limitations  of  Traditional 
Social  Network  Analysis  vis-a- 
vie  Available  Data 


■ 

Abdul  Aziz  Al-Oma 
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■  Flight  UA  #175  -  Crashed  Into  WTC  South 

■  Other  Associates,  ef  Hijackers 

Coflpgm  ©  2CC  * .  Vw»  Knew 


Waleed  Alshehri 


Wail  Alshehri 


Satam  Suqami 


Standard  social  network  analysis 
provides  the  user  with  a  number  of 
tools  for  characterizing  these  networks 
and  analyzing  this  data. 
Unfortunately,  such  tools  are  in  a 
sense  rigid  vis-a-vie  the  kind  of  data 
that  is  likely  to  be  available.  For 
example,  in  this  area  there  are  vast 
quantities  of  data  on  people,  events,  groups  and  the  diverse  relations  among  them  such  as 
finance,  authority,  and  influence.  In  other  words  the  data  is  incomplete,  inaccurate,  dynamic, 
multi-mode  and  multi-plex.  Further,  the  fact  that  many  groups  are  trying  to  operate  in  a  covert 
matter,  the  lack  of  sufficient  public  records,  the  difficulty  collecting  information  and  translating 
it,  the  large  and  diverse  agendas  of  the  informants  leads  to  data  that  is  incomplete,  inaccurate,  as 
well  as  potentially  out-of-date  and  intentionally  wrong.  Carley  (2003)  cited  a  number  of  relevant 
limitations  for  using  the  traditional  social  network  analysis  approach  to  examine  terrorist  groups: 
“Traditionally,  social  network  analysis  (SNA)  has  focused  on  small,  bounded 
networks,  with  2-3  types  of  links  (such  as  friendship  and  advice)  among  one  type  of 
node  (such  as  people),  at  one  point  in  time,  with  close  to  perfect  information.  To  be 
sure  there  are  a  few  studies  that  have  considered  extremely  large  networks,  or  two 
types  of  nodes  (people  and  events),  or  unbounded  networks  (such  as  inter- 
organizational  response  teams);  however,  these  are  the  exception  not  the  norm. 
However,  such  studies  are  still  the  exception  not  the  rule.  Further,  while  it  is 
understood,  at  least  in  principle  how  to  think  about  multi-modal,  multi-plex,  dynamic 
networks,  the  number  of  tools,  the  interpretation  of  the  measures,  and  the  illustrative 
studies  using  such  “higher  order”  networks  are  still  in  their  infancy  relative  to  what  is 
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available  for  simpler  networks.  Finally,  many  of  the  tools  do  not  scale  well  with  the 
size  of  the  network  or  degrade  gracefully  with  errors  in  the  network;  e.g.,  they  may 
be  too  computationally  expensive  or  too  sensitive  to  both  type  1  and  2  errors.” 

Many  of  these  limitations  are  simply  technical  challenges  that  new  metrics  and  algorithms 
can  over  come.  One  difficulty  that  is  particularly  troublesome  traditional  social  network 
analysis,  however,  is  the  dynamics  of  these  networks.  Consider,  for  example,  Hamas.  In  Figure 
2,  Meshaal  is  shown  as  being  associated  with  the  Damascus  region  but  not  necessarily  with  a 
cell.  If  at  this  point  he  was  in  a  cell  it  was  probably  infrastructure.  Toward  the  end  of  Yassin’s 
life  Meshaal  was  out  of  favor  with  Yassin  and  kept  away  from  him;  whereas,  prior  to  that  he  may 
have  been  in  operations.  Now,  after  the  assassination  of  Yassin,  Meshaal  has  arisen  to  be  the 
acting  head  of  Hamas  in  Gaza,  but  may  well  have  little  power  ( 
http://www.debka.com/article.php?aid=813;  http://www.debka.com/article.php?aid=812  ). 
What  is  needed  is  a  way  of  reasoning  about  such  change,  the  ability  to  reduce  surprise  by 
providing  some  estimates  of  the  impact  of  certain  changes,  and  the  ability  to  “pre-evaluate” 
actions  take  to  mitigate  or  increase  the  effectiveness  of  the  opponent.  To  date,  a  standard 
approach  here  is  to  attempt  to  predict  change  based  on  the  estimates  of  subject  matter  experts 
using  largely  the  subjective  high-level  data  often  narrowed  to  a  particular  area  of  expertise. 
Developing  dynamic  network  analysis  is  not  a  simple  exercise  in  the  extension  or  adaptation  of 
existing  metrics.  Instead,  it  requires  fundamentally  new  metrics,  tools,  and  theories. 

A  second  major  problem  is  the  incompleteness  and  inaccuracy  of  the  data.  Two  types  of  data 
were  discussed  -  high  level  general  and  detailed  specific.  Both  types  bring  their  own  problems. 
The  high-level  data  is  in  a  sense  more  complete;  that  is,  it  provides  a  broader  description  of  the 
structure  of  the  underlying  terrorist  organization,  identifies  the  types  of  nodes  and  relations,  and 
paints  a  picture  of  the  “on-average”  relations.  It  is  important  to  keep  in  mind  that  such  high  level 
data  is  often  collected  by  subject  matter  experts  who  may  have  an  area  of  specialty  narrowed  by 
time,  region,  or  specific  actor.  Hence,  generating  an  over-arching  picture  requires  integration 
across  these  experts.  Further,  such  high  level  data  is  subjective  and  so  potentially  over  or 
understates  the  relative  importance  or  frequency  of  types  of  relations.  Social  network  or 
relational  thinking  facilitates  the  collection  of  such  high  level  data.  However,  the  resultant  data 
is  so  general  that  social  network  analytic  techniques  cannot  be  fruitfully  applied. 

In  contrast,  the  detailed  data  is  eminently  suited  to  the  tools  of  social  networks.  Such  data 
provides  a  very  detailed  picture  of  the  specific  connections  among  specific  nodes;  but  often,  for 
only  a  subset  of  the  overall  organization.  The  data  is  likely  to  be  more  accurate  about  the  highly 
central  or  hub  actors  than  the  less  central,  the  actors  who  are  visible  in  the  political  context  of  the 
community,  or  who  act  as  leads.  Such  data,  being  collected  often  in  a  more  semi-automated 
fashion,  can  be  collected  to  cross  over  areas  of  specialty  and  so  not  be  bound  by  temporal, 
regional  or  actor  bounds  as  it  the  subject  matter  expert.  As  a  result,  integration  is  more 
automatic  and  data  extraction  more  systematic.  Nevertheless,  the  lack  of  fully  automated  tools  to 
extract  such  data  means  that  data  collection  is  arduous  and  so  researchers  often  limit  the  scope  of 
analysis  to  data  that  is  readily  available  (such  as  membership  data  or  information  in  newspapers) 
often  associated  with  a  specific  event  -  such  as  Tanzania  embassy  bombing  (Carley  et  ah,  2003 
or  the  9-11  hijackers  (Krebs,  2002).  Such  detailed  data  is,  in  this  sense,  more  objective  and  so 
provides  more  accurate  estimates  of  the  importance  or  frequency  of  some  relations  and  the 
networks  around  some  nodes.  Nevertheless,  there  are  gaping  holes  in  such  data  from  missing  the 
overall  picture.  In  general,  what  is  needed  is  a  way  of  combining  these  two  types  of  data,  using 
each  type  to  mitigate  the  limitations  of  the  other,  and  so  reaping  the  benefits  of  both  and 
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estimating  the  shape  and  structure  of  the  underlying  networks  so  that  the  tools  of  social  network 
analysis  can  be  applied. 

3  Network  Dynamics 

As  noted,  we  need  to  combine  these  two  types  of  data  and  we  need  to,  given  the  combined 
data,  estimate  how  these  networks  change.  Further,  since  there  are  still  likely  to  be  missing  data 
and  errors  in  the  combined  data,  we  need  to  be  able  to  place  the  results  in  a  risk  context  and 
estimate  how  missing  data  is  likely  to  affect  the  results.  Finally  we  need  to  be  able  to  interpret 
the  results,  in  part,  by  understanding  the  characteristics  of  the  key  individuals  in  the  network  and 
the  network  itself. 

In  this  analysis,  we  start  by  discussing  how  the  data  was  combined.  This  is  followed  by  a 
discussion  of  the  attributes  that  characterize  actors  and  what  they  mean  and  the  tool  used  to 
extract  those  measures  (ORA).  Then,  these  networks  are  evolved  using  a  multi-agent  network 
simulation  tool  (DyNet).  Then,  to  illustrate  the  ability  to  reason  about  these  networks 
dynamically  a  series  of  virtual  experiments  are  run  in  which  various  actors  are  isolated.  To 
interpret  the  results  the  characteristics  of  the  actors  that  are  removed  or  whose  position  changes 
are  examined. 

3.1  Combining  the  Data 

In  order  to  examine  the  available  data  using  the  simulation  and  networks  it  is  necessary  to 
build  a  meta-matrix  representation  for  each  of  the  al-Qa’ida  and  Hamas  networks.  The  meta¬ 
matrix  is  a  conceptual  representation  of  network  data  that  combines  the  social  network  with  other 
types  of  networks,  such  as  the  knowledge  network.  The  meta-matrix  is  in  fact,  a  multi-mode 
multi-plex  representation  of  a  network.  For  this  study  we  focus  on  three  key  types  of  entities  - 
actors,  knowledge  and  groups  and  the  relations  among  them.  To  begin  with,  the  high-level 
general  data  is  used  to  create  the  matrices  in  the  meta-matrix  with  particular  attention  to  the 
actor-by-actor,  actor-by-knowledge,  actor-by-group  and  knowledge-by-group  matrices.  Then  the 
detailed  data  is  used  to  adjust  overall  parameters  in  the  simulation  and  to  augment  the 
connections  among  those  actors  being  simulated  for  which  the  real  world  analog  is  known  (e.g., 
the  connection  between  Yassin  and  Meshaal.  Rather  than  describe  the  creation  of  each  matrix  in 
the  meta-matrix  for  both  terrorist  groups,  the  process  is  illustrated  by  describing  the  creation  of 
the  actor-by-group  network,  the  actor-by-actor  authority  network  and  the  actor-by-knowledge 
knowledge  network  for  Hamas. 

Actor-by-group:  For  example,  we  might  build  a  Hamas  network  in  which  there  is  an  overall 
leader  and  five  groups  for  regions  and  another  five  groups  for  functions.  We  would  then  select  a 
number  of  actors.  If  more  detailed  information  is  used  it  can  be  used  to  inform  the  number  of 
actors  to  be  simulated,  or  the  ratio  of  the  size  of  the  groups  to  each  other.  Assume  for  the 
moment  that  there  are  only  3 1  actors,  1  leader,  5  regional  leaders,  and  25  cell  members.  Then 
based  on  the  high  level  data  we  would  expect  a  matrix  like  that  in  Table  2.  To  this  we  can  use 
detailed  data  to  note  that  Meshaal  is  part  of  the  infrastructure  group  in  Damascus  and  that 
Rantissi  is  a  lead  operations  person  in  Gaza.  This  could  be  used  to  add  two  additional 
individuals  to  the  table,  resulting  in  33  total  actors. 
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Table  2.  Actor-by-Group 

Actor-  by¬ 
group 

Group 

1  - 
Gaza 

Group 

2- 

West 

Bank 

Group  3  - 
Damascus 

Group  4 

Lebanon 

Group 

5- 

Egypt 

Group  6 

internal 

security 

Group  7 

popular 

uprising 

Group  8  - 

professional 

killer 

Group  9 
-  suicide 
bombing 

Group  10- 
infrastructure 

Yassin 

1 

Gaza 

Leader 

1 

West  Bank 
Leader 

1 

Damascus 

Leader 

1 

Lebanon 

Leader 

1 

Egypt 

Leader 

1 

member 

1 

1 

member 

1 

1 

member 

1 

1 

member 

1 

1 

member 

1 

1 

member 

1 

1 

member 

1 

1 

member 

1 

1 

member 

1 

1 

member 

1 

1 

member 

1 

1 

member 

1 

1 

member 

1 

1 

member 

1 

1 

member 

1 

1 

member 

1 

1 

member 

1 

1 

member 

1 

1 

member 

1 

1 

member 

1 

1 

member 

1 

1 

member 

1 

1 

member 

1 

1 

member 

1 

1 

member 

1 

1 

Meshaal 

1 

1 

Rantissi 

1 

1 

Actor-by-actor:  An  actor-by-actor  binary  matrix  is  created  representing  the  lines  of  authority. 
This  is  shown  in  table  3.  In  this  case  a  tie,  a  1,  indicates  that  the  person  in  the  row  reports  to  the 
corresponding  person  in  the  column.  Rows  and  columns  are  ordered  the  same.  Again  specific 
ties,  such  as  that  between  Rantissi  and  Yassin  are  added. 

Actor-by-knowledge:  An  actor-by-knowledge  binary  matrix  is  created  such  that  the 
distribution  of  “facts”  (who  knows  what)  are  distributed  across  group  members  as  suggested  by 
the  high-level  information.  The  “facts”  or  types  of  knowledge  are  sub-divided  into  social, 
regional,  and  functional.  All  actors  in  the  same  function  have  roughly  equivalent  functional 
knowledge.  All  actors  in  the  same  region  have  roughly  equivalent  regional  information. 
Regional  and  functional  leaders  are  given  a  little  more  knowledge  than  their  underlings  to 
represent  the  impact  of  training  and  experience.  In  addition,  regional  and  functional  leaders  are 
given  social  knowledge  of  the  overall  leader  Yassin.  Yassin  is  given  a  sample  of  both  functional 
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and  regional  knowledge  and  social  knowledge  of  the  functional  and  regional  leaders.  For  space 
purposed  this  matrix  is  not  shown 


Table  3.  Actor-by- Actor 

Actor-  by- Actor 

Yassin 

000000000000000000000000000000000 

Gaza  Leader 

100000000000000000000000000000000 

West  Bank  Leader 

100000000000000000000000000000000 

Damascus  Leader 

100000000000000000000000000000000 

Lebanon  Leader 

100000000000000000000000000000000 

Egypt  Leader 

100000000000000000000000000000000 

member 

010000000000000000000000000000001 

member 

010000000000000000000000000000001 

member 

010000000000000000000000000000001 

member 

010000000000000000000000000000001 

member 

010000000000000000000000000000001 

member 

001000000000000000000000000000000 

member 

001000000000000000000000000000000 

member 

001000000000000000000000000000000 

member 

001000000000000000000000000000000 

member 

001000000000000000000000000000000 

member 

000100000000000000000000000000000 

member 

000100000000000000000000000000000 

member 

000100000000000000000000000000000 

member 

000100000000000000000000000000000 

member 

000100000000000000000000000000000 

member 

000010000000000000000000000000000 

member 

000010000000000000000000000000000 

member 

000010000000000000000000000000000 

member 

000010000000000000000000000000000 

member 

000010000000000000000000000000000 

member 

000001000000000000000000000000000 

member 

000001000000000000000000000000000 

member 

000001000000000000000000000000000 

member 

000001000000000000000000000000000 

member 

000001000000000000000000000000000 

Meshaal 

000100000000000000000000000000000 

Rantissi 

110000000000000000000000000000000 

Once  these  matrices  are  created  they  can  then  be  analyzed  to  estimate  the  properties  of  the 
actors,  entered  as  input  into  the  simulation  system  to  estimate  performance  and  possible  changes. 
Further,  as  new  information  is  uncovered  it  can  be  used  to  expand  or  alter  these  matrices  thus 
enabling  expectations  based  on  the  data  to  be  rapidly  updated.  Possible  changes  might  be,  for 
the  al-Qa’ida  network  the  incorporation  of  the  9-11  hijackers.  Another  possible  change  might 
be,  in  the  case  of  Hamas,  to  alter  the  proportional  sizes  of  the  groups.  For  example,  as  there  is 
reason  to  believe  that  there  are  more  people  in  Gaza  and  the  West  Bank  one  might  wish  to 
double  the  number  of  individuals  associated  with  each  of  those  groups.  Since  there  is  reason  to 
believe  that  there  are  few  individuals  in  the  operations  cells  in  Damascus,  Egypt  and  Lebanon 
then  the  number  of  actors  in  those  cells  might  be  reduced  to  zero  or  to,  at  least,  many  fewer  than 
in  Gaza  and  the  West  Bank.  Finally,  in  order  to  estimate  the  robustness  of  the  results  generated 
using  these  matrices  one  need  only  randomly  permute  the  matrices  by,  e.g.,  adding  or  dropping  a 
percentage  of  links  (edges)  or  nodes. 
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3.2  Characterizing  Actors  and  the  Network  -  ORA 

Some  actors  are  liable  to  stand  out  in  any  network  for  various  reasons.  For  example,  they 
may  be  highly  central  in  the  social  network  (individual  who  is  connected  to  most  others)  or  they 
may  be  high  in  cognitive  demand  (previously  called  load;  with  a  great  deal  of  demands  on  their 
time  due  to  needs  to  communicate,  work  on  complex  tasks,  etc.).  These  and  other  critical  aspects 
the  terrorist  network  can  be  identified  using  ORA.  ORA  (CMU, 

http://www.casos.ece.cmu.edu/proiects/ORA/index.html,  Carley  and  Reminga,  2004)  -  evaluates 
potential  organizational  risks  based  upon  meta-matrix  data.  ORA  contains  a  large  number  of 
measures  of  organizational  vulnerability  based  upon  various  organizational,  operations  research, 
and  communication  factors.  Recently,  vulnerability  measures  developed  through  the  analysis  of 
Team  X  at  NASA  have  been  added  to  ORA.  Note,  ORA  is  designed  to  gracefully  degrade  in 
the  face  if  missing  matrices.  That  is,  it  calculates  only  those  measures  that  apply  given  the 
matrices  of  data  that  are  available  and  for  many  measures  has  “reduced  form  estimates”  that  are 
calculated  only  on  the  available  matrices. 


Actors 

Knowledge 

Tasks 

Groups 

Actors 

Social 

Network 

Knowledge 

Network 

Assignment 

Network 

Membership 

Network 

Knowledge 

Information 
Network  / 

Needs 

Network 

Core 

Capabilities 

Tasks 

Precedence 

Ordering 

Institutional 

Relation 

Groups 

Inter- 

organizational 

Network 

r 

1 

■ 

ORA 

1 

•  1 

L 

1 

Vulnerability  AMjg 
*  V\m o  is  critical 

Adaptability  ^S'S  p  thinK 

l^SSn***** 

2'  Ef  cognitive 

rsss&s.  . 


Figure  4.  ORA  Tool 

For  al-Qa’ida  and  Hamas  networks  developed  herein,  there  are  three  measures  that  we  find  of 
particular  importance  in  assessing  agent  characteristics  -  degree  centrality  and  cognitive  demand. 
Further,  there  is  one  measure  of  the  overall  network  that  is  valuable  -  overall  complexity 
(basically  density  of  overall  meta-matrix  number  of  ties  divided  by  number  of  potential  ties). 
These  measures  have  been  shown  to  be  valuable  in  the  past  when  considering  how  to  destabilize 
and  influence  networks  (Borgatti  (2002),  Carley  et  al.;  2001;  2003).  It  is  important  to  note  that  if 
we  had  other  data,  such  actor  to  task  data,  then  it  would  be  possible  to  estimate  not  only  general 
performance  as  is  done  in  the  next  section,  but  also  “congruence”  the  tendency  of  the 
organization  to  be  structured  such  that  the  social,  knowledge  and  assignment  networks  are 
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congruent  with,  match  well  with,  the  needs  of  the  organization  and  the  order  of  tasks  to  be  done.1 
This  is  important  for  most  organizations  as  higher  congruence  corresponds  to  higher 
performance. 

When  applied  to  the  two  networks,  some  interesting  differences  arise.  See  table  4.  First, 
neither  group  is  very  complex;  i.e.,  both  networks  are  extremely  sparse.  In  part,  this  is  indicative 
of  major  amounts  of  missing  data.  However,  it  is  important  to  note  that  more  detailed  data  on  al- 
Qa’ida  (Sagemen,  forthcoming;  Krebs,  2002;  Carley  et  al.,  2003)  also  indicate  a  very  sparse 
network.  Thus,  this  may  simply  be  an  indication  of  a  cellular  structure  in  which  some  cells  can 
be  self  directed.  The  case  for  Hamas,  however,  is  less  clear  as  there  are  as  yet  fewer  network 
studies  of  components  of  that  organization.  Second,  it  is  important  to  note  that  the  formal 
leaders  exhibit  different  network  characteristics.  Usama  bin  Ladin  appears  to  both  connect  to  the 
most  others  and  to  have  the  most  to  do.  This  suggests,  purely  on  the  basis  of  position,  that 
removing  him  from  al-Qa’ida  may  have  more  of  an  impact  on  the  network  than  removing  Yassin 
from  Hamas;  but,  the  removal  of  either  is  likely  to  be  destabilizing.  It  is  important  to  keep  in 
mind  that  these  “predictions”  are  only  guesses  based  on  the  structural  position  of  the  actor.  They 
do  not  take  in  to  account  the  impact  of  network  dynamics. 


Table  4.  Characteristics  of  Networks  and  Key  Actors 

Characteristics 

Meaning 

al-Qa’ida 

Hamas 

Complexity 

Very  low  then  probably  major  amounts 
of  missing  data,  possibly  cells  are  self 
directed.  Very  high  then  system  is  tightly 
coupled  and  possibly  prone  to  group 
think. 

slightly  more 
complex 

Overall  -  very 
low  density 

slightly  less 
complex 

Overall  -  very 
low  density 

Highest  in 

degree 

centrality 

Individual  most  likely  to  diffuse  new 
information,  isolation  of  this  person  will 
be  slightly  crippling  for  a  short  time. 

Bin  Ladin 

Yassin 

Highest  in 

cognitive 

demand 

Individual  most  likely  to  be  an  emergent 
leader,  isolation  of  this  person  will  be 
moderately  crippling  for  a  medium  time 

Bin  Ladin 

Rantissi 

3.3  Strategic  Change  through  Actor  Isolation  -  DyNet 

The  question  now  is  “What  is  the  dynamic  profile  of  these  alternative  terrorist  networks?”. 
Can  we  do  better  than  guessing  what  is  likely  to  occur  when  an  actor  is  isolated?  To  evaluate  the 
behavior  over  time  of  these  networks  the  tool  DyNet  (CMU:  Carley  et  al.,  2003)  is  used.  A 
conceptual  overview  of  DyNet  is  provided  in  Figure  5. 

DyNet  is  a  multi-agent  network  model  of  network  natural  and  strategic  evolution.  It  is 
intended  to  be  a  desktop  tool  for  reasoning  about  dynamic  networked  and  cellular  organizations 
under  varying  levels  of  missing  information.  The  purpose  of  the  DyNet  project  is  to  develop  the 
equivalent  of  a  flight  simulator  for  reasoning  about  dynamic  networked  organizations  or  groups 
by  blending  ideas  from  computer  science  and  social  networks.  As  a  result,  DyNet  is  a  reasoning 
support  tool  for  reasoning  under  varying  levels  of  uncertainty  about  dynamic  networked  and 


1  When  measures  such  as  congruence  are  available,  it  is  possible  to  use  ORA  to  estimate  the  optimality  of  the 
proposed  network.  The  optimum  organizational  structure  is  calculated  using  a  general  multi-criteria  optimization 
function  available  within  ORA  (Carley  and  Kamneva,  2004). 


12 


cellular  organizations,  their  vulnerabilities,  and  their  ability  to  reconstitute  themselves.  Using 
DyNet  analysts  are  able  to  see  how  the  networked  organization  is  likely  to  evolve  if  left  alone, 
how  its  performance  can  be  affected  by  various  information  warfare  and  isolation  strategies,  and 
how  robust  these  strategies  are  in  the  face  of  varying  levels  of  information  assurance. 


Figure  5.  Conceptual 
View  of  DyNet 


The  basic  cycle  in 
DyNet  is  that  actors 
interact,  send  and/or 
receive  information  or 
queries.  The  flow  of 
information  effects 
learning  on  the  part  of 
the  actors  which  in 
turn  alters  who  is 
likely  to  interact  with 

whom.  Two  key  factors  influence  interaction  -  homophily  and  information  seeking.  In  the  first 
case,  actors  are  more  likely  to  interact  just  in  case  they  have  more  in  common  relative  to  what 
they  have  in  common  with  others.  In  the  second  case,  an  actor  is  more  likely  to  seek  another  out 
if  the  first  actor  thinks  that  the  other  knows  more  (of  what  he/she  does  not  know)  relative  to  all 
others.  These  mechanisms  are  related  to,  and  predictive  of,  social  and  advice  giving  networks 
(Carley,  2002). 

Figure  6.  Expected 
Performance 

DyNet  takes  the  meta¬ 
matrix  as  input  and  then 
predicts  group  and  individual 
outcomes  such  as 
performance,  information 
diffusion,  and  development 
of  consensus.  Herein,  we 
have  done  this  in  a  Monte- 
Carlo  fashion  such  that  each 
of  the  terrorist  groups  was 
simulated  multiple  times  and 
the  results  averaged. 
Statistical  tests  reveal  that 
the  lines  shown  in  Figure  6  and  7  are  significantly  different.  The  resultant  behavior  of  the  two 
terrorist  networks  is  shown  in  Figure  6.  Basically,  what  we  see  here  is  that  DyNet  is  predicting 
that,  on  average  al-Qa’ida  will  exhibit  higher  performance  than  will  Hamas. 


Performance  Over  Time 


-al-Qa'ida 

-Hamas 


Time 
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What  is  likely  to  happen  if  the  formal  leader  is  removed.  This  question  too  can  be  addressed 
with  DyNet.  Here,  the  two  networks  are  re-simulated  but  this  time  with  the  leader  removed.  See 
figure  7.  There  are  two  main  things  to  note.  First,  for  Hamas,  the  removal  of  the  leader  actually 
leads  to  improved 
performance.  Since  many 
top  members  of  Hamas  are 
known  to  be  more  militant 
than  Yassin,  one  might 
expect  this  to  mean 
increased  violence.  As  a 
sign  of  validation,  note 
that  since  Yassin’s  death 
the  activity  level  in  Hamas 
has  increased.  Second,  for 
al-Qa’ida  the  removal  of 
the  formal  leader  degrades 
performance. 

Figure  7.  Expected 
performance  after  removal  of  formal  leader. 

Of  course,  formal  leaders  tend  to  be  hard  targets.  We  might  ask,  what  would  happen  were  to 
random  cell  members  to  be  isolated.  In  this  case  (not  shown)  the  simulation  suggests  that  al- 
Qa’ida’s  performance  drops  but  it  recovers.  Whether  the  drop  is  more  or  less  than  in  Hamas 
appears  to  depend  on  the  structural  position  of  the  actors  who  are  isolated.  In  particular,  removal 
of  mid-level  actors,  such  as  regional  leaders  who  are  also  functional  leaders  in  Hamas  appears  to 
degrade  performance. 

A  second  question  we  might  ask  is,  who  will  emerge  as  the  formal  leader  after  the  formal 
leader  is  isolated.  For  the  data  used  here,  it  is  difficult  to  predict  exactly  who  that  will  be,  in  part 
as  there  is  little  information  on  specific  individuals.  The  DyNet  program  does  make  some 
suggestions.  In  general  individuals  with  high  cognitive  demand  emerge  as  leaders,  at  least 
temporarily.  In  the  case  of  al-Qaida  there  are  a  number  of  actors  with  roughly  comparable 
cognitive  demand  who  could  emerge  leading  to  a  multi-headed  hydra.  In  the  case  of  Hamas, 
DyNet  suggests  that  Rantissi  is  likely  to  emerge.  A  word  of  caution  is  necessary,  however. 
These  simulations  were  done  not  taking  into  account  the  historic  and  negative  ties  to  Meshaal. 
Were  we  to  add  those  ties,  we  would  see  that  the  performance  of  Hamas  still  improves  when 
Yassin  is  removed,  but  that  it  is  now  difficult  to  tell  which  of  Rantissi  or  Meshaal  will  become 
the  formal  leader.  In  this  secondary  analysis,  both  Rantissi  and  Meshaal  are  emergent  leaders 
and  play  temporarily  pivotal  roles. 

4  Potential  Risks 

Error  in  network  data  can  take  the  form  of  missing  or  additional  nodes  or  edges  (ties).  We 
have  begun  an  analysis  of  the  impact  of  such  errors  on  correctly  estimating  centrality  and 
cognitive  demand  in  general  (correlation)  and  in  specific  (locating  the  top  person)  (Carley, 
Reminga  and  Borgatti,  2003).  This  analysis,  to  date,  has  been  done  on  Erdos  random  graphs. 
Preliminary  results  indicate  that  for  Erdos  random  networks,  the  ability  to  correctly  estimate  the 
individual  who  is  highest  in  degree  centrality  or  cognitive  demand  degrades  linearly  with  the 
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-al-Qa'ida  without  leader 
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amount  of  error.  The  degradation  in  estimation  appears  faster  for  cellular  networks  and  may  not 
be  linear.  This  is  critical  as  for  random  networks  all  destabilization  tactics  (such  as  isolation  of 
the  individual  that  is  highest  in  centrality  or  cognitive  demand)  have  approximately  the  same 
effect;  but  for  cellular  networks  cognitive  demand  is  more  effective. 

There  are  two  issues  to  apply  this  result  to  the  foregoing  work.  First,  how  much  data  is 
missing.  At  a  detailed  network  level,  the  pictures  are  missing  well  over  50%  of  the  data  at  the 
actor  level.  At  the  component  or  group  level,  the  missing  data  is  possibly  closer  to  10%.  As 
such  the  results  are  more  likely  to  be  right  for  overall  group  effects  than  individual.  In  other 
words,  it  is  likely  that  the  predictions  about  the  impact  of  removing  a  leader  are  more  likely  to  be 
right  than  predictions  about  their  successors.  The  second  issue  is,  to  what  extent  is  the  missing 
data  uniformly  missing  from  the  network.  Here  we  note  that  due  to  the  attention  of  the  media  on 
the  formal  leaders,  and  due  to  the  ease  of  finding  general  than  detailed  data,  again  it  is  more 
likely  that  the  results  surrounding  bon  Ladin  and  Yassin  are  right  compared  to  those  for,  e.g., 
Rantissi. 


5  Limitations  and  Future  Work 

While  the  work  presented  moves  us  a  fair  way  to  understanding  and  predicting  the  dynamics 
of  these  networks,  it  still  does  not  handle  a  variety  of  issues.  For  example,  the  current  system  is 
weak  at  linking  regional  based  specialties  to  actors.  An  example  of  regional  specialties  is  that 
weapons  deliveries  to  Hamas  go  from  Egypt,  through  either  "normal"  smuggling  channels  or 
underground  tunnels  under  the  border  (Katz,  1999).  Such  factors  are  currently  not  possible  to 
simulate  in  DyNet. 

Another  critical  limitation  is  that  the  current  technologies  cannot  account  for  behavior  related 
to  the  social  or  political  context.  In  terms  of  social  context,  for  example,  in  Hamas,  the 
infrastructure  cells  provide  services  to  the  local  population  (such  as  running  religious  schools  - 
where  children  parade  on  holidays  in  fake  suicide  vests)  (Katz,  1999).  Each  of  the  three  sub¬ 
services  in  the  infrastructure  cell  probably  has  its  own  heads  who  report  to  the  chief  of 
infrastructure.  As  to  political  context,  the  current  approach  has  difficulty  linking  state  level 
actions  to  the  individual.  For  examples,  in  the  case  of  Hamas,  Khaled  Meshaal  is  the  leader  of 
the  "political  wing",  lives  in  Damascus  and  enjoys  full  legitimacy  from  the  Syrian  government, 
including  luxurious  headquarters  in  the  center  of  the  city.  As  another  example,  Jordan  does  not 
endorse  Hamas  (Katz,  1999).  Such  social  and  political  context  information  is  difficult  to  utilize 
currently,  yet  is  clearly  important  from  an  overall  perspective. 

It  is  clear  that  future  system  needs  to  consider  how  to  bring  such  contextual  information  in. 
Doing  so,  we  note,  is  non-trivial.  At  CMU  in  the  CASOS  lab  we  are  currently  exploring  possible 
ways  of  linking  such  context  information  to  DyNet.  At  the  technology  level  it  requires  multi¬ 
level  modeling  integrating  micro  and  macro  modeling  tools  which  is  an  unsolved  problem.  At 
the  theoretical  level,  little  is  known  about  individual  differences  in  balancing  social,  political  and 
group  level  concerns  and  goals.  At  the  empirical  level,  the  validity,  collection  and  bias  issues  at 
each  level  are  distinct  and  little  is  known  about  how  to  calibrate  data  across  levels. 

Perhaps  the  one  item  that  is  likely  to  have  the  most  impact  on  the  model  and  the  analysis  is 
the  incorporation  of  negative  linkages.  In  the  case  of  Hamas,  when  previous  connections  to 
Meshaal  were  included  Meshaal  emerged  along  with  Rantissi  as  an  emergent  leader.  In  al- 
Qa’ide  most  of  the  previous  work  shows  that  elimination  of  one  leader  leads  to  multiple 
emergent  leaders.  In  this  work,  such  individuals  emerge  due  to  the  high  level  of  cognitive 
demand  they  are  under  and  so  their  ability  to  act  as  change  agents  due  to  their  structural  position 
(position  in  the  network).  However,  as  political  and  military  science  informs  us,  lines  of  alliance 
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as  well  as  lines  of  hostility  are  critical  in  effecting  political  change.  Moreover,  understanding 
such  linkages  enables  alternative  attack  strategies  (like  pitting  one  side  against  another)  also  to 
be  examined.  As  negative  as  well  as  positive  linkages  are  added  to  DyNet  we  expect,  therefore, 
to  be  able  to  facilitate  examining  political  as  well  as  structural  change. 

In  summary,  an  approach  for  taking  incomplete  and  potentially  inaccurate  data  and  reasoning 
about  change  has  been  described  and  illustrated.  Key  features  of  this  work  include:  using 
detailed  network  data  to  supplement  high  level  views  of  organizations  to  create  a  composite 
image,  using  network  metrics  for  multi-mode,  multi-plex  data  to  characterize  key  actors  and  the 
network  itself,  and  using  multi-agent  simulation  to  predict  change  in  the  composite  network  view 
over  time.  Uncertainty  is  handled  by  using  two  types  of  data  to  reduce  uncertainty,  running  the 
model  in  a  Monte-Carlo  fashion  to  determine  the  robustness  of  the  results,  and  examining  the 
robustness  of  the  results  under  adding  and  dropping  nodes  and  edges  in  the  underlying  networks. 
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Expected  Performance  After 
Removal  of  Top  Leader 


Performance  impact  of  removing  top  leader 


1  18  35  52  69  86  103  120  137  154  171  188 


Time 


al-Qa'ida  without  leader 
Hamas  without  leader 
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CASKS. 


Hamas 


s 


Range  in  Estimates 


Density 
*  .03/. 05 

*  CD  Yassin  -  .05/.04 

♦  Degree  -  2 

But  -  since  the  structure  is 


Al-Qaeda 

#  Density 

*.02/.096  (.01  to  .03) 

*  CD  bin  Ladin  -  .05/.028 

♦  Degree  2 


apx  consistent  - 
the  results  hold 


Typical  social  network 

^  Density 

*.3 

&  Degree  7 
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Key  Ideas  of 
Dynamic  Network  Analys' 


Meta-Matrix 


People 

Knowledge 

People 

Relation 

Social 

Network 

Who  knows  who 

Knowledge 

Network 

Who  knows  what 

Assignment 

Network 

Who  does  what 

Knowledge 

Relation 

Information 

Network 

What  informs  what 

Needs  Network 

What  knowledge  is 
needed  to  do  that  task 

Tasks 

Relation 

Precedence 

Network 

Which  tasks  must  be 
done  before  which 

Combine 

Networks  +  multi-agent 
Social  science  +  computer  science 
Conceptual  +  network  data 


Emergent  leaders  -  cognitive  demand 


June  2004 


©  Kathleen  M.  Carley  -  CMU  ISRI  CASOS 


r 


^Dynamic  measures 

^Visualizing  dynamics 

^Social  “zooming”  on  the  visuals 

^Simulations  -  linking  actions  (beyond 
communication)  and  networks 

^Explore  personality  additions 

^Explore  power  added  by  using  graph  based  pattern 
detection  -  like  proximity 
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Related  Work 

AutoMap  -  semi-auto  extraction  of  network  data  from 

texts 

ORA- 

DyNet  -  evaluation  of  network  dynamics  and 
destabilization  policies 

NetWatch  -  impact  of  data  integration,  sharing  and 
control  on  ability  to  detect  evolving  network 
BioWar  -  city  scale  multi-agent  network  model  of 
weaponized  biological  attacks 
OrgAhead  -  multi-agent  network  model  of  evolving 
organizational  forms 

Construct  -  co-evolution  of  agent  mental  models  and 
social  networks 


ThreatFinder  -  social/knowledge  management  system 
for  locating  IP  security  risks 

Vista  -  estimating  the  evolving  likelihood  and  impact  of 
unanticipated  events  in  urban  settings 
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